CVE-2026-81205: CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in Drupal LDAP / Active Directory Integration

This vulnerability, identified as CWE-90 LDAP Injection, exists in the Drupal LDAP / Active Directory Integration module. It allows an attacker to inject special elements into LDAP queries due to improper input neutralization. The affected versions include all versions from 0.0.0 up to 2.2.1. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact is limited to partial confidentiality loss (C:L), with no integrity or availability impact. No vendor advisory or patch information is currently available, and no known exploits have been reported.

The vulnerability allows attackers to perform LDAP Injection, potentially enabling unauthorized access to LDAP query results or manipulation of LDAP queries. The CVSS score indicates limited confidentiality impact without affecting integrity or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should monitor official Drupal security channels for updates. No official mitigation or temporary fix has been published.